CVE-2026-91928
UnknownSummary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects versions before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
Risk Assessment
XSS vulnerability can allow an attacker to execute scripts in the victim's browser, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
Upgrade Apache Sling XSS to version 2.4.12 or later.
Other vulnerabilities in Apache Sling XSS
See all- CVE-2026-92001Unknown
Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects versions before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
- CVE-2026-91999Unknown
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects versions before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
- CVE-2026-91852Unknown
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects versions before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
- CVE-2026-73192Unknown
A reflected cross-site scripting (CWE-79) vulnerability in Apache Sling XSS version 2.4.10 and prior, caused by improper neutralization of input in the XSSAPI.getValidHref() method. An attacker can submit an unsanitized value, allowing script execution in the victim's browser in every feature using this method.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.